Gentoo’s dead.
Before I hear you say “Long live Gentoo!” I should add that, yes, I know it has an active supporting community. Certainly there are other forks of Gentoo (Sabayon and Funtoo among the most well known of these) that contribute fixes upstream. There’s even a lively community discussing things on the gentoo-dev list. There’s also a lot of good, clever and very smart individuals working on Gentoo from around the world. I envy each and every one of them and admire their dedication and their technical capabilities and contributions.
For me, however, Gentoo is dying on the vine. It will continue to live on for others–there’s plenty of dedicated souls who are more than willing to support it, run it on their servers, home computers, and suffer through another rough period in Gentoo’s colorful history–but my days of running Gentoo are coming to an end. Why? Because I feel that:
- It lacks clear direction
- Recent security-related issues are a concern
- Package support and maintainers are dwindling in number
- Changing personal preferences
Clear Direction?
Does Gentoo have a clear direction? I think so–or I used to. When the maintainer of OpenRC left to move on to bigger and better things, a lengthy discussion took place, and unsurprisingly, some individuals were calling out for Gentoo to follow suit with other distros to use other init systems. Fortunately, I think the conclusion at the end was that OpenRC will still have a home with Gentoo, and it will be moved (or moved back) into being an in-house project. The discussion does raise some red flags, and I sincerely hope Gentoo doesn’t change toward adopting init systems that go against the spirit of the distribution. Personally, I liked OpenRC–it was fast, it showed a great deal of promise, and that there are forces within the community that would rather move toward a more mainstream (and bloated) init system is worrisome. I’m not sure that sentiment is shared with the majority of developers (I hope not), but that this is even a concern is troubling because I do not want to migrate my systems to one or more different init systems over the next year or two.
I think it’s also fair to deduce that Gentoo no longer pushes updates as frequently as other distributions. This isn’t necessarily a bad thing–and some might argue that it’s a sign of maturity–but it does call into question whether or not certain critical security patches will ever be rolled out relatively quickly. Moreover, many languages, libraries, and other developer-centric tools aren’t being included or updated as frequently as other distributions. Updates, if available, seem to stagnate in ~arch for an eternity before they’re deemed suitable for general availability. While I don’t want Gentoo to become yet another Debian or Ubuntu, subsequently pushing out moderately unstable software in effort to stay on the bleeding edge, I would have appreciated the integration of some established tools–like PHP 5.3–sooner. PHP 5.3 wasn’t introduced into portage until May of 2010 at version 5.3.2, and I think this sort of delay is endemic to a good chunk of the system. That’s to say nothing about how long it took to adopt Python version 2.5 several years ago, mostly thanks to Portage’s dependency on Python, but at least Python 3 has been available in parallel with Python 2 for quite some time. Other software isn’t so lucky.
Security
Years ago, Gentoo used to push updates to various critical components like glibc often enough to coin the joke “I’m sorry I can’t go out tonight, I’m having to recompile my kernel again.” Unfortunately and for various reasons, the security team has been stretched to the point that critical vulnerabilities have gone untouched for an undesirably long time. This isn’t the fault of Gentoo, nor is it the fault of anyone in particular. As Tobias Heinlein stated on the mailing list:
The Gentoo Security team is functional, but running on low flame. There is a huge backlog (a huge amount of open bugs and GLSAs that still need to be sent) and due to a small amount of active members not all bugs are filed/handled in a timely manner and bigger packages (Firefox, Java, etc.) are not easy to draft GLSAs for for various reasons.
There’s just too much work to do and too few hands to do it. It certainly explains the IA32 emulation issue on 64-bit multilib builds, and it possibly explains why advisories like this one were delivered an uncomfortably long time after the exploits were discovered. Of course, patches are no replacement for end-user security as, ultimately, security rests on the shoulders of the systems administrator.
There is a silver lining. In spite of Gentoo’s recent lapse with pushing updates, they have still managed to beat both Microsoft and Adobe in terms of patch turn around and deployment.
Package Support
Whether or not Gentoo is currently hemorrhaging developers is something of a rumor. I don’t think it is. I do think that the current economy has put unwanted constraints on individual contributors who have already been constrained by time; that’s expected. Every distribution sees a slow turn over rate for developers, and I think Gentoo is in that phase where the number of developers leaving is somewhat greater than the number of new developers taking their place. I deduce this mostly by anecdotal evidence. Also, things like the following don’t help either (this is a comparison between several major players in the F/OSS OS market):
Gentoo:
[sagittarius:~]$ emerge --search yui Searching... [ Results for search key : yui ] [ Applications found : 0 ] |
Ubuntu 10.10 (server)
[corvus:~]$ aptitude search yui p libjs-yui - Yahoo User Interface Library p libjs-yui-doc - Documentation and examples for the Yahoo User Interface Library p yui-compressor - JavaScript/CSS minifier |
FreeBSD 8.1
[exfar:~]$ portsearch -n yui Port: yui-3.2.04_2 Path: /usr/ports/editors/yui Info: Rich-featured multi-windows console text editor Maint: [email protected] B-deps: autoconf-2.67 autoconf-wrapper-20071109 m4-1.4.15,1 perl-5.10.1_2 R-deps: WWW: Port: yuicompressor-2.4.2 Path: /usr/ports/www/yuicompressor Info: The Yahoo! JavaScript and CSS Compressor Maint: [email protected] B-deps: R-deps: desktop-file-utils-0.15_2 gamin-0.1.10_4 gettext-0.18.1.1 gio-fam-backend-2.24.2 glib-2.24.2 inputproto-2.0 javavmwrapper-2.3.5 jdk-1.6.0.3p4_18 kbproto-1.0.4 libX11-1.3.3_1,1 libXau-1.0.5 libXdmcp-1.0.3 libXext-1.1.1,1 libXi-1.3,1 libXtst-1.1.0 libiconv-1.13.1_1 libpthread-stubs-0.3_3 libxcb-1.7 pcre-8.10 perl-5.10.1_2 pkg-config-0.25_1 python26-2.6.6 recordproto-1.14 xextproto-7.1.1 xproto-7.0.16 WWW: http://developer.yahoo.com/yui/compressor/ 2 ports |
There are comparisons like this all across the board. It holds true for the YUI libraries, for the Spring framework, and a handful of other minor packages here and there that I’ve run into over the last year and a half. It should be noted that there were three reasons I migrated from FreeBSD to Gentoo some 5-6 years ago: 1) the ports collection wasn’t being updated as frequently as I would have liked, 2) the ports collection often didn’t have packages I needed or wanted, and 3) FreeBSD (-release–I don’t know about –current or –stable from the time period) did not easily support the new printer I had purchased whereas Gentoo did. Oh, how the tables turn.
Now, it should be stated that missing packages aren’t the end of the world. One can easily go search for the latest version, find it, and install it. That’s not the problem. The problem is that as I’ve gotten older (lazier) and more time constrained (impatient), I like to spend less and less time hunting down sundry packages and more time actually doing things. Package managers are the path of least resistance, and as long as they make something easier to do, I’m going to use them. ./configure && make && make install was fun when I was 20. I’m now 29 and have a gazillion different hobbies in addition to paid labor (usually writing code but mostly dealing with data migration and the sorts). I don’t want to have to fool around with some inane package manager any more than necessary (although I do like Portage). Which brings me to…
Personal Preference
This is the one point no one is going to be able to argue with. Gentoo is a labor of love. I used to enjoy having authoritarian control over every little package on the system. It was fantastic building a new install and having only those packages I wanted (and their dependencies) and nothing else. Nowdays, any time I run an:
# emerge -pvu world # or system |
…and see more than 30 packages listed, I breathe a sigh of frustration. I used Gentoo as my primary desktop OS for about 2 years between 2006 and 2008, so I know how long it takes to build X, build KDE, and build the various silly libraries needed to support each of them (and whatever else I wanted). In fact, I still have that particular installation of Gentoo sitting on my other drive at home. Ever since I took a .NET class during my last year of college, I realized that sometimes it’s better to get things done than it is to sit, twiddling my thumbs, waiting for that overnight build to finish so I can check e-mail. (Then getting frustrated and turning on my laptop or cancelling the build and booting to Windows.) Granted, I always loved having two disparate operating systems on the same machine: If one failed for whatever reason (Windows), I could boot to Gentoo and still get stuff done. Anymore, though, I’m rather wishing I had installed Ubuntu in place of Gentoo. If I had a nickle for every hour I spent waiting for various window manager breaking emerges to finish…
Crux of the Matter
The crux of this entire long winded post is that I’m getting really damn frustrated with Gentoo. I love the operating system. I’ve used it for years. (Side note and minor correction: I actually first used Gentoo in late 2003/early 2004, but I don’t count those because my home server was still running FreeBSD.) I want to continue using it, but I’m afraid my patience is wearing thin. I seem to remember that a particular friend of mine Tweeted about dumping Gentoo for the U-word earlier this year. I hate to say it, but I’m afraid I’m going to follow suit. “Enter Ubuntu,” as he said. Enter Ubuntu indeed.
And to think: I hate Debian with a passion. I guess there are other BSD-ish options, although I do seem to see VirtualBox OSE in the FreeBSD ports collection… Tempting!
Update July 24th, 2011
Gentoo’s not dead! Rather, that is for me it isn’t. This entire post should have been taken with a grain of salt, but I’ll explain in depth later this week why I feel that this post was not only entirely unfair, but also why I feel that Gentoo has redeemed itself, and why I believe competition is important (or more to the point: why sampling the competition is important).
